CVSS 4.0
6.9 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:NCVE-2026-54332
Medium (6.9) in gopacket gopacket. EPSS 0.8% chance of exploitation in the next 30 days. Fixed in github.com/gopacket/gopacket 1.6.1.
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gopacket:gopacket
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-g6v3-7xmc-w563 | Go | github.com/gopacket/gopacket | <1.6.1 | 1.6.1 |
| GO-2026-6122 | Go | github.com/gopacket/gopacket | <1.6.1 | 1.6.1 |